# OAuth & Security

OAuth consent, account route scopes, bearer forwarding, cache policy, and the boundary between account access and execution.

Last updated: 2026-07-22

Canonical HTML: https://stakao.com/docs/oauth
Raw Markdown: https://stakao.com/docs/oauth.md

## Table of contents

- 01. [Consent and credentials](#consent)
- 02. [Route scopes](#scopes)
- 03. [Proxy and cache policy](#proxy-policy)
- 04. [No agent execution](#no-execution)

## 01. Consent and credentials

Account-bound access requires a Supabase OAuth 2.1 bearer token and active Stakao consent for the token client_id.

Public discovery, catalog, search, MCP, and x402 allocation analysis do not require OAuth. OAuth is used only when an agent requests account-bound data or submits a human-reviewed activation request.

### Account request

```bash
curl -i https://api.stakao.com/agent/account/me \
  -H 'Authorization: Bearer <supabase-oauth-access-token>'
```

## 02. Route scopes

The backend enforces both token scopes and the scopes stored in the active Stakao consent.

- GET https://api.stakao.com/agent/account/me — openid.
- GET https://api.stakao.com/agent/account/wallets — openid profile.
- GET https://api.stakao.com/agent/account/strategies — openid profile.
- POST https://api.stakao.com/agent/account/activation-requests — openid profile email.
- GET/POST https://api.stakao.com/agent/mcp/account — openid profile transport access; tool-specific calls enforce their account scope.

## 03. Proxy and cache policy

The Worker forwards Authorization only on exact account routes and never caches account responses.

- Public x402 and public MCP requests have Authorization removed before origin forwarding.
- Account responses use Cache-Control: private, no-store.
- 401 responses preserve or synthesize WWW-Authenticate: Bearer.
- Cookies, bearer tokens, OAuth bodies, and account payloads are excluded from Worker logs.

## 04. No agent execution

OAuth account access does not grant on-chain execution authority.

Account reads are tenant-scoped to the authenticated user. request_activation creates a PENDING record for human review. It does not sign, create a proxy, create a delegate transaction, write user_strategies, or call the chain.

## Agent entrypoints

- [Agent manifest](https://api.stakao.com/agent): Worker-generated discovery manifest and safety metadata.
- [Agent OpenAPI](https://api.stakao.com/agent/openapi.json): Canonical REST contract generated by the Worker.
- [Agent llms.txt](https://api.stakao.com/agent/llms.txt): Worker-generated operational instructions.
- [Agent errors](https://api.stakao.com/agent/errors.json): Machine-readable error codes and remediation.
- [Public MCP](https://api.stakao.com/agent/mcp): Unauthenticated read-only MCP transport.
- [Auth reference](https://stakao.com/auth.md): Raw authentication and payment reference.

## Related Stakao references

- [AI Agents](https://stakao.com/docs/ai-agents): Start here for the complete agent flow.
- [Docs hub](https://stakao.com/docs): Canonical technical documentation index.
- [Full Markdown corpus](https://stakao.com/llms-full.txt): Complete docs and safety corpus.
- [Strategies Markdown](https://stakao.com/strategies.md): Generated strategy catalog.

## Related blog articles

- [Agent-native staking API](https://stakao.com/blog/agent-native-staking-api): Editorial context for the public agent API.
- [x402 payments for AI agents](https://stakao.com/blog/x402-payments-for-ai-agents): Editorial context for x402 payment retries.
- [MCP server for crypto staking agents](https://stakao.com/blog/mcp-server-for-crypto-staking-agents): Editorial context for the public MCP surface.